PT-2018-9309 · Electron · Electron
Brendan Scarvell
·
Publicado
2018-03-23
·
Atualizado
2019-10-03
·
CVE-2018-1000136
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Electron versions 1.7 up to 1.7.12
Electron versions 1.8 up to 1.8.3
Electron versions 2.0.0 up to 2.0.0-beta.3
Description:
The issue is related to an improper handling of values in Webviews, which can result in remote code execution. This can be exploited via an app that allows execution of 3rd party code, disallows node integration, and has not specified if webview is enabled or disabled. The application must also meet specific conditions, including running on affected Electron versions, allowing execution of arbitrary remote code, disabling Node.js integration, and not explicitly declaring webviewTag as false.
Recommendations:
For Electron versions 1.7 up to 1.7.12, update to version 1.7.13 or later.
For Electron versions 1.8 up to 1.8.3, update to version 1.8.4 or later.
For Electron versions 2.0.0 up to 2.0.0-beta.3, update to version 2.0.0-beta.5 or later.
If an update is not possible, mitigate the vulnerability by using the provided code to disable node integration and webviewTag in webPreferences, and prevent new-window events from overriding event.newGuest without using the supplied options tag. Additionally, consider preventing the attachment of webviews if they are not used.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Electron